Script interpreter spawns child process shortly after network beacon (post-C2 RAT execution)

Renata Cardoso@rcardososec

•updated Aug 10, 2026•1•0•2

Detects a script host process (wscript.exe/cscript.exe) making a network connection followed by that same script host spawning a child process on the same host, consistent with a RAT retrieving and executing attacker-supplied code after establishing a C2 beacon